Antirius Auth Cloud for OpenCart

Antirius Auth Cloud for OpenCart

Storefront login via messengers, order notifications through Message API, email verification in the customer account. OpenCart 3.0.x.

Download extension
OpenCart 3.0.x

PHP 7.4+ with openssl, outbound HTTPS to Auth Cloud


What the extension does

  • Intercepts account/login and register; shows the Auth Cloud widget on a dedicated login page.
  • Customer confirms login in a messenger; the store receives session_id and exchanges it for a JWT.
  • JWT signature verification via JWKS (RS256) — no shared secrets on the shop server.
  • Optional auto-creation of OpenCart customers on first login; placeholder email @antirius.local until the customer confirms a real address.
  • Matches existing customers by telephone only (customer.telephone). Phone in the profile is changed only via messenger re-bind.
  • Order status notifications via Auth Cloud Message API (email, messenger, both, or customer choice).
  • Customer account: test messenger delivery, confirm email with a code sent to the linked phone, choose notification channel.
  • Password fallback link on messenger screen enabled by default; opt-out setting to hide it.
  • Admin must bind their phone via the widget in module settings before the module can be enabled.

Before installation

1. Sign in to the Auth Cloud cabinet and create an application.

2. Connect at least one messenger bot (Telegram, WhatsApp or MAX) in application settings.

3. Open the application → Messages tab: copy the message API token (POST /api/v1/message/send). You will paste it into OpenCart module settings for order notifications and test sends.

4. Add your storefront origin (scheme + host, e.g. https://shop.example.com) to allowed domains — required for the widget and session API.

5. Copy the application _id — you will enter it as Application ID in OpenCart admin.


Installation

1. Download antirius-auth-cloud-opencart.zip using the button above.

2. In OpenCart admin: Extensions → Installer → upload the zip, or unpack the upload/ folder into the shop root.

3. Extensions → Extensions → Modules → Antirius Auth Cloud → Install.

4. Click Edit: Base URL, Application ID, message API token, order notification mode, bind admin phone, use “Send test” to verify delivery, then enable and save.

5. If you upgrade from an older package: reinstall the module once (or add order-history events and table antirius_customer_meta manually) so notifications work.


Module settings

SettingDescription
StatusEnable to replace the default customer login flow.
Base URLAuth Cloud instance URL (e.g. https://id.antirius.com).
Application IDApplication _id from the cabinet.
Widget script URLOptional; default {base_url}/widget.js.
Auto-create customerCreate a new customer record if no match is found.
Customer groupDefault group for newly created customers.
User matchingTelephone only: customer.telephone must match the number from Auth Cloud.
Message API tokenFrom cabinet → application → Messages. Used for order notifications and test sends. Leaving the field empty on save keeps the previously stored token.
Order status notificationsWhen admin checks “Notify customer” on an order: Email only (OpenCart mail), Messenger only (API), Both, or Customer choice (if phone and verified email). Messenger channel is chosen by Auth Cloud (Telegram / MAX / WhatsApp per app settings).
Send test (admin)Sends a test message to the bound administrator phone via the message API.
Hide password fallback on messenger screenNo (default) — backup link to account/login?abc_bypass=1 is shown. Yes — hide the on-screen link only.

Order notifications

When the order history is updated with “Notify customer”, the extension calls POST /api/v1/message/send if messenger delivery applies. OpenCart still sends email when the mode includes email. The shop does not pick Telegram vs MAX — Auth Cloud delivers via the application configuration.

Email onlyStandard OpenCart mail only.

Messenger onlyNo OpenCart email; text to customer phone in E.164 format.

BothEmail and messenger.

Customer choiceIf the customer has a verified phone and a real confirmed email, they choose email or messenger in Account → Edit. Otherwise fallback: messenger when email is a placeholder, email when a real address exists.


Customer account (Account → Edit)

1. Telephone is read-only; change it only via “Re-link” / messenger bind.

2. Notifications block (when message API token is configured): “Test delivery” — customer checks that messages arrive and decides whether to use the channel.

3. Confirm email: enter a real address, receive a one-time code in the messenger on the linked phone, then confirm. Replaces placeholder @antirius.local.

4. Notification channel: radio buttons email / messenger — only when the shop uses “Customer choice” and both phone and email are verified.


Login flow

1. Customer opens Account → Login (route account/login).

2. Extension redirects to extension/module/antirius_auth_cloud/login with the widget and CSRF token in session.

3. Customer completes auth in the messenger; the browser POSTs session_id to extension/module/antirius_auth_cloud/callback.

4. Shop server calls GET /api/v1/auth/session/{session_id}?type=full once, receives JWT, verifies RS256 via /.well-known/jwks.json.

5. Extension finds or creates a customer, calls $this->customer->login(), redirects to account/account or the original redirect URL.


Emergency password login

A link to the standard OpenCart login is shown on the messenger screen by default. You can also open it directly (cookie keeps bypass mode after form POST):

index.php?route=account/login&abc_bypass=1

To hide only the on-screen link, set “Hide password fallback on messenger screen” to Yes in module settings. The direct URL above still works.

Security

Callback accepts POST only and checks the CSRF token stored in the OpenCart session (abc_auth_token). JWT is verified with the public key from JWKS; app_id in the token must match the configured Application ID. Personal profile fields come from the messenger at auth time and are not stored on Auth Cloud long-term.

Requirements

  • OpenCart 3.0.x (catalog MVC extension, events). OpenCart 4.x is not supported in this package.
  • PHP 7.4+ with openssl extension.
  • Outbound HTTPS from the shop server to Base URL (session API, JWKS, widget.js).
  • Storefront domain listed in application allowed domains in the cabinet.

Documentation